Detections
Analytics

EulerOS 2.0 SP1 : nettle (EulerOS-SA-2016-1061)

critical Nessus Plugin ID 99823

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the nettle packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 - Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages(C++, Python, Pike, ...), in applications like LSH or GNUPG, or even in kernel space.

 - Secure Fix(es):

 - The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.(CVE-2015-8803)

 - x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.(CVE-2015-8804)

 - The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.(CVE-2015-8805)

 - It was found that nettle's RSA and DSA decryption code was vulnerable to cache-related side channel attacks.
 An attacker could use this flaw to recover the private key from a co-located virtual-machine instance.(CVE-2016-6489)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected nettle packages.

See Also

http://www.nessus.org/u?0ed2fc0b

Plugin Details

Severity: Critical

ID: 99823

File Name: EulerOS_SA-2016-1061.nasl

Version: 1.14

Type: local

Published: 5/1/2017

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:huawei:euleros:nettle, p-cpe:/a:huawei:euleros:nettle-devel, cpe:/o:huawei:euleros:2.0

Required KB Items: Host/local_checks_enabled, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Patch Publication Date: 11/3/2016

Reference Information

CVE: CVE-2015-8803, CVE-2015-8804, CVE-2015-8805, CVE-2016-6489